markhoerth opened a new issue, #14435:
URL: https://github.com/apache/gravitino/issues/14435
### Version
main branch, commit bb634defdc5663a8124be5fca1c8d9e52ac096ac (2.0.0-SNAPSHOT)
### Describe what's wrong
A vulnerability scan of the server distribution built from main
(`distribution/package` and `distribution/package-all` ship the same jars)
reports five CRITICAL findings. Two of them (netty-handler 4.1.118.Final and
4.1.63.Final, GHSA-c4c3-7fpv-j4q5) are covered by same-line patch bumps tracked
in the companion ticket datastrato/gravitino-enterprise#2903. The other three
need a change of release line and are tracked here:
| Library | Shipped version | Advisory | Fixed in |
|---|---|---|---|
| org.apache.avro:avro | 1.7.7 (shaded) | GHSA-r7pg-v2c8-mfg3 /
CVE-2024-47561 | 1.11.4 |
| org.apache.ranger:ranger-plugins-common | 2.4.0 | GHSA-c87w-642h-m97h /
CVE-2025-59059 | 2.8.0 |
| org.apache.zookeeper:zookeeper | 3.6.3 | GHSA-7286-pgfv-vxvh /
CVE-2023-44981 | 3.7.2, 3.8.3, 3.9.1 |
The exploitability calls below come from reading the Gravitino code. They
have not been proven by test.
**1. avro 1.7.7, CVE-2024-47561 (schema parsing in the Avro Java SDK before
1.11.4 allows arbitrary code execution)**
- Where it ships: there is no standalone avro 1.7.7 jar. Avro 1.7.7 is
shaded inside `hadoop-client-runtime-3.3.6.jar` (relocated to
`org/apache/hadoop/shaded/org/apache/avro`, with
`META-INF/maven/org.apache.avro/avro/pom.properties` reporting
`version=1.7.7`). That jar is in `authorizations/ranger/libs`,
`catalogs/fileset/libs`, `catalogs/lakehouse-iceberg/libs`,
`iceberg-rest-server/libs` and `iceberg-rest-server-experiment/libs`. The
unshaded avro jars that also ship are already fixed (1.12.1 in
`catalogs/glue/libs`, `catalogs/lakehouse-iceberg/libs` and
`iceberg-rest-server/libs`; 1.12.2 in `iceberg-rest-server-experiment/libs`).
- Gradle: `gradle/libs.versions.toml:49` (`hadoop3 = "3.3.6"`) and `:272`
(`hadoop3-client-runtime`), declared by
`authorizations/authorization-ranger/build.gradle.kts:74`,
`catalogs/catalog-fileset/build.gradle.kts:51`,
`catalogs/hadoop-common/build.gradle.kts:37` and
`iceberg/iceberg-common/build.gradle.kts:70` (which feeds the Iceberg catalog
and both Iceberg REST server packages).
- Reachability: likely not reachable. No Gravitino source outside tests
references `org.apache.avro` or the shaded package. The shaded copy is used by
Hadoop internals such as `AvroSerialization` and MapReduce job history, which
Gravitino does not call; Gravitino uses Hadoop for FileSystem and UGI/Kerberos.
Iceberg reads manifests with the unshaded avro 1.12.x. No request body or
user-supplied file reaches the shaded `Schema.Parser`.
- Target: a Gradle constraint cannot replace classes shaded inside another
jar, so the fix is a Hadoop upgrade or a move off the shaded client. Hadoop
3.4.1 does not fix it: its `hadoop-project` POM sets `avro.version` to 1.9.2.
The options are a Hadoop release whose `hadoop-client-runtime` shades avro
1.11.4 or later (not yet identified), or switching these modules to
`hadoop-client-api` plus `hadoop-common` with avro pinned to 1.11.4 or 1.12.x.
Either way it is a change of Hadoop release line (3.3 to 3.4 or later) and
needs compatibility testing of the fileset catalog, the Iceberg catalog and
REST service with HDFS and Kerberos, and the Ranger authorization plugin.
**2. ranger-plugins-common 2.4.0, CVE-2025-59059 (remote code execution in
`NashornScriptEngineCreator` in Ranger up to 2.7.0)**
- Where it ships:
`authorizations/ranger/libs/ranger-plugins-common-2.4.0.jar` only, next to
`ranger-intg-2.4.0.jar`. The jar contains the affected classes
(`org/apache/ranger/plugin/util/NashornScriptEngineCreator`,
`ScriptEngineUtil`, `RangerRequestScriptEvaluator`,
`RangerScriptConditionEvaluator`).
- Gradle: `gradle/libs.versions.toml:157` (`ranger = "2.4.0"`) and `:376`
(`ranger-intg`), pulled in by
`authorizations/authorization-ranger/build.gradle.kts:56`
(`implementation(libs.ranger.intg)`); `ranger-intg:2.4.0` depends on
`ranger-plugins-common:2.4.0`.
- Reachability: likely not reachable. The authorization plugin uses only the
Ranger Admin REST client and model classes (`RangerClient`,
`RangerServiceException`, `RangerPolicy`, `RangerRole`, `RangerService`,
`RangerServiceDef`, `GrantRevokeRoleRequest`, `SearchFilter`); the client is
created at
`authorizations/authorization-ranger/src/main/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationPlugin.java:118`.
Gravitino never runs `RangerBasePlugin`, the policy engine, condition
evaluators or a script engine, so policies are sent to Ranger Admin and never
evaluated in the Gravitino process. JDK 17 also has no built-in Nashorn, and no
Nashorn or GraalJS jar ships in `authorizations/ranger/libs`.
- Target: 2.8.0. It stays on the 2.x line but skips four minor releases, so
it needs compatibility testing: the `RangerClient` API used by
`RangerClientExtension`, the transitive dependencies trimmed by the excludes at
`authorizations/authorization-ranger/build.gradle.kts:57-72`, and the plugin
against the Ranger Admin versions in use.
**3. zookeeper 3.6.3, CVE-2023-44981 (with SASL quorum peer authentication
enabled, a missing instance part in the SASL auth ID skips the authorization
check, so an arbitrary endpoint can join the ensemble)**
- Where it ships: `zookeeper-3.6.3.jar` and `zookeeper-jute-3.6.3.jar` in
`catalogs/hive/libs/hive-metastore2-libs` and
`catalogs/hive/libs/hive-metastore3-libs`.
- Gradle: `hadoop3.common` in
`catalogs/hive-metastore2-libs/build.gradle.kts:44` and
`catalogs/hive-metastore3-libs/build.gradle.kts:49` brings
`hadoop-common:3.3.6`, which depends on `zookeeper:3.6.3`. The same version
also arrives through `hadoop-auth`, `curator-client` and the Hive shims (which
ask for 3.4.6 and are resolved up to 3.6.3).
- Reachability: not reachable. The vulnerable code is the server-side quorum
peer authorizer, and Gravitino never runs a ZooKeeper server or quorum peer. No
Gravitino source outside tests references `org.apache.zookeeper` or
`org.apache.curator`. ZooKeeper is on the Hive catalog classpath only as a
client library for the Hive metastore client.
- Target: 3.8.4 or a 3.9.x release (3.6 and 3.7 are end of life). Both build
files already have a `constraints` block
(`catalogs/hive-metastore2-libs/build.gradle.kts:37`,
`catalogs/hive-metastore3-libs/build.gradle.kts:42`) where `zookeeper` and
`zookeeper-jute` can be pinned. 3.8.4 is the version Hadoop 3.4.1 uses. It is a
change of release line (3.6 to 3.8), so the Hive catalog should be tested
against Hive metastore 2.3 and 3.1, including with Kerberos.
### Error message and/or stacktrace
Scanner output for the built distribution (CRITICAL and above):
```
io.netty:netty-handler:4.1.118.Final GHSA-c4c3-7fpv-j4q5 CRITICAL (covered
by datastrato/gravitino-enterprise#2903)
io.netty:netty-handler:4.1.63.Final GHSA-c4c3-7fpv-j4q5 CRITICAL (covered
by datastrato/gravitino-enterprise#2903)
org.apache.avro:avro:1.7.7 GHSA-r7pg-v2c8-mfg3 CRITICAL
org.apache.ranger:ranger-plugins-common:2.4.0 GHSA-c87w-642h-m97h CRITICAL
org.apache.zookeeper:zookeeper:3.6.3 GHSA-7286-pgfv-vxvh CRITICAL
```
### How to reproduce
1. Build the distribution at commit
bb634defdc5663a8124be5fca1c8d9e52ac096ac: `./gradlew compileDistribution -x
test`.
2. Scan it: `trivy rootfs --severity CRITICAL distribution/package`.
3. Confirm the shipped copies:
```
find distribution/package -name 'zookeeper-3.6.3.jar' -o -name
'ranger-plugins-common-2.4.0.jar' -o -name 'hadoop-client-runtime-3.3.6.jar'
unzip -p
distribution/package/iceberg-rest-server/libs/hadoop-client-runtime-3.3.6.jar
META-INF/maven/org.apache.avro/avro/pom.properties
```
### Additional context
- Companion ticket for the same-line patch bumps (Jackson, netty, httpcore5,
xnio, mssql-jdbc, the PostgreSQL driver in the Paimon catalog, and the MCP
server lockfile): datastrato/gravitino-enterprise#2903.
- Related: #13157 (release and test image advisory follow-up, which notes
the shaded avro in `hadoop-client-runtime-3.3.6.jar`), #688 (an earlier CVE
dependency update, closed).
- Found by the 2.0 OSS test suite check
`test_no_vulnerabilities_at_fail_severity`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
